AWSCloudTrail - Creation of Access Key for IAM User

Status: available
Severity: medium
Time window: 15m
Source: github.com/Azure/Azure-Sentinel

Detects creation of a new IAM access key on an existing user account, which could be used to establish persistence. This action should be validated by the AWS account administrator. Reference: https://stratus-red-team.cloud/attack-techniques/AWS/aws.persistence.iam-backdoor-user/

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098.001` Account Manipulation: Additional Cloud Credentials

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `CreateAccessKey`: Creates a new AWS access key pair (access key ID and secret access key) for the specified IAM user.

Rules detecting the same action

These rules filter on the same operation.

ASL AWS Create Access Key (Splunk)
AWS CreateAccessKey (Splunk)
AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity (Elastic)
New IAM Credentials Updated (Panther)
Root Account Access Key Created (Panther)
User impersonation by Identity Protection alerts (Kusto)

Rule body

id: 9a6554e6-63d9-4f94-9b32-64d1d40628f2
name: AWSCloudTrail - Creation of Access Key for IAM User
description: |
  Detects creation of a new IAM access key on an existing user account, which could be used to establish persistence. This action should be validated by the AWS account administrator. Reference: https://stratus-red-team.cloud/attack-techniques/AWS/aws.persistence.iam-backdoor-user/
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AWS
    dataTypes:
      - AWSCloudTrail
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
relevantTechniques:
  - T1098.001
query: |
    AWSCloudTrail
    | where EventName == "CreateAccessKey" 
    | project-away SourceSystem,Category,Type,TenantId,EventVersion,SessionIssuerAccountId
    | extend UserName = substring(UserIdentityPrincipalid, indexof_regex(UserIdentityPrincipalid, ":") + 1)
    | extend Name = split(UserName,'@')[0],UpnSuffix = split(UserName,'@')[1]
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: Name
      - identifier: UPNSuffix
        columnName: UpnSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIpAddress
customDetails:
  EventName: EventName
  AWSRegion: AWSRegion
  UserAgent: UserAgent
alertDetailsOverride:
  alertDisplayNameFormat: IAM access key created by {{Name}} in {{AWSRegion}}
  alertDescriptionFormat: User {{Name}} (principal {{UserIdentityPrincipalid}}) created a new IAM access key in region {{AWSRegion}}.
version: 1.0.2
kind: Scheduled

Stages and Predicates

Stage 1: `source`

AWSCloudTrail

Stage 2: `where`

| where EventName == "CreateAccessKey"

Stage 3: `project-away`

| project-away SourceSystem,Category,Type,TenantId,EventVersion,SessionIssuerAccountId

Stage 4: `extend`

| extend UserName = substring(UserIdentityPrincipalid, indexof_regex(UserIdentityPrincipalid, ":") + 1)

Stage 5: `extend`

| extend Name = split(UserName,'@')[0],UpnSuffix = split(UserName,'@')[1]

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventName`	eq	`CreateAccessKey`	`field:"aws::eventName" kind:eq value:"CreateAccessKey"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`UserName`	`extend`
`Name`	`extend`
`UpnSuffix`	`extend`